From 1cc05c01b14802d5b391e198649870b5ec284b07 Mon Sep 17 00:00:00 2001
From: Siteshcodes <siteshgupts985@gmail.com>
Date: Tue, 4 Aug 2026 20:40:36 +0530
Subject: [PATCH] fix(api): validate deviceId before ObjectId conversion

---
 api/src/webhook/webhook.service.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/api/src/webhook/webhook.service.ts b/api/src/webhook/webhook.service.ts
index 3281c45..9fa5d98 100644
--- a/api/src/webhook/webhook.service.ts
+++ b/api/src/webhook/webhook.service.ts
@@ -217,6 +217,13 @@ export class WebhookService {
     }
 
     if (deviceId) {
+      if (!mongoose.Types.ObjectId.isValid(deviceId)) {
+        throw new HttpException(
+          'Invalid deviceId',
+          HttpStatus.BAD_REQUEST,
+        )
+      }
+
       commonPipeline.push({
         $match: {
           'deviceData._id': new mongoose.Types.ObjectId(deviceId),